Secure Remote Desktop with Remote Credential Guard

Remote Credential Guard is a Windows security feature that protects your credentials when you connect to a remote desktop. It uses Kerberos to redirect the authentication process back to your local device, so your password or smart card credentials are never sent to the remote machine. This article explains how it works, how to enable it, and what to do when it won’t start.

What Remote Credential Guard Does

When you sign in to a remote PC with standard RDP, your password is transmitted to that machine, where it is processed by the Local Security Authority (LSA). If the remote PC is compromised, an attacker with administrative access can dump your credentials from memory. Remote Credential Guard eliminates this risk by keeping the authentication on your local device. Instead of sending your password, the remote system receives a Kerberos service ticket, and the actual validation happens locally. This means that even if the remote machine is malicious, your password never leaves your computer.

Requirements and Limitations

Before you enable Remote Credential Guard, you need to meet these conditions:

• Both the client and the remote host must be joined to an Active Directory domain.
• The client must run Windows 10 (version 1607 or later) or Windows 11, and the remote host must run Windows 10 (version 1607 or later), Windows Server 2016, or a newer version.
• You must connect using the Remote Desktop Connection (MSTSC) client—the Microsoft Store version does not support this feature.
• Kerberos authentication must be available; NTLM is not supported.
• You cannot use this feature with a Microsoft account (like @outlook.com) or a local account; it requires a domain account.

If your environment uses a workgroup or Azure AD, Remote Credential Guard will not work. In those cases, you can use the older Restricted Admin mode, which also prevents credential delegation but works with local accounts.

How to Enable Remote Credential Guard

You can enable it either on the client side (for a single connection) or via Group Policy (for many machines).

Client-Side (Per Connection)

1. Open Remote Desktop Connection (mstsc.exe).
2. Enter the computer name and click Show Options.
3. Go to the Advanced tab.
4. Under Authentication, click Settings.
5. Select Use Remote Credential Guard and click OK.

If the option is greyed out, your client does not meet the requirements (e.g., not domain-joined or using the Store app).

Group Policy (For Multiple Computers)

1. In Group Policy Management, create a new GPO or edit an existing one.
2. Navigate to Computer Configuration > Administrative Templates > System > Credentials Delegation.
3. Open Restrict delegation of credentials to remote servers.
4. Enable it and add the remote host’s name (use TERMSRV/computer-name).
5. Also enable Use Remote Credential Guard in the same policy.

After applying the policy, restart the client and try connecting again.

How It Works Under the Hood

When you initiate a Remote Credential Guard connection, the RDP client asks the local Kerberos service for a ticket to the remote host. That ticket is then passed to the remote LSA, which uses it to validate your identity—but the actual password check happens on your machine. The remote host never sees your password or even a hash of it. This is similar to how Restricted Admin mode works, but Remote Credential Guard also supports smart card authentication and multi-factor, making it a more complete solution.

Common Problems and Fixes

If Remote Credential Guard fails to connect, you will see an error like “The remote computer requires Network Level Authentication� or “Your credentials did not work.� Here are the typical causes and solutions:

• NLA is disabled on the remote host. Enable Network Level Authentication in System Properties > Remote > Advanced.
• Kerberos is not available. Ensure both machines can reach a domain controller and that the client is not using a local account.
• Group Policy is blocking it. Check the Restrict delegation policy to make sure the remote host is allowed.
• You are using the Microsoft Store RDP app. Switch to the classic MSTSC client.
• The remote host is not domain-joined. Remote Credential Guard only works in a domain environment.

If you still have issues, try connecting with mstsc /restrictedAdmin to see if that works—this tells you the problem is specific to Remote Credential Guard.

Comparing Remote Credential Guard and Restricted Admin

Restricted Admin mode is an older feature that also prevents credential delegation. It works by not sending your password at all—you are logged on with a token that has no credentials. However, it only supports password authentication and does not work with smart cards or MFA. Remote Credential Guard is the recommended replacement because it supports more authentication methods and is easier to manage via Group Policy. Both are better than standard RDP, but Remote Credential Guard is the more robust choice for domain environments.

Security Considerations and Best Practices

Remote Credential Guard is not a complete security solution. It protects your credentials from being stolen on the remote host, but it does not encrypt the RDP session itself—that is handled by TLS. Also, it does not protect against a compromised local machine. If your computer is infected with malware, that malware could still capture your keystrokes or read your memory. For maximum security, always use strong passwords, enable MFA, and keep your systems patched. Additionally, Remote Credential Guard only works when the remote host is trusted; if you connect to an untrusted machine, it will fall back to standard RDP, so always verify the host name before connecting.

Frequently Asked Questions

Does Remote Credential Guard work with Azure AD or Microsoft accounts?

No. It requires an Active Directory domain account. For Azure AD, you can use Windows Hello for Business or a VPN with MFA, but not Remote Credential Guard.

Can I use Remote Credential Guard with Remote Desktop Gateway?

Yes, but the gateway must be configured to allow it. The client and the target host must both support it, and the gateway must not strip the Kerberos ticket. In practice, you may need to enable the “Use Remote Credential Guard� policy on the gateway as well.

What is the difference between Remote Credential Guard and Credential Guard?

Credential Guard is a local security feature that isolates the LSA in a virtualized container to protect against credential theft on the device itself. Remote Credential Guard is specifically for RDP sessions and prevents credentials from being sent to a remote machine. They are separate features but can be used together.

Will Remote Credential Guard slow down my connection?

No. The authentication process is slightly faster because it avoids sending a password over the network. The actual RDP session speed is unaffected.

Can I use Remote Credential Guard with non-Windows clients?

No. It is a Windows-only feature. Linux or macOS clients cannot use it.

Related

• Types of Headphones: Full Guide to Every Style
• Batching vs Low Latency: Stream Ingestion Settings
• Catch Bugs Lures Tier List